Privacy Policy
Last updated 1 September 2026. box1 is published by Fearing Labs.
box1 works completely without an account. If you never sign in, nothing about you or your collection leaves your device, and there is no record of you on any server. Everything below describes what happens only once you choose to sign in or to buy the premium unlock.
What box1 collects
| What | When | Why |
|---|---|---|
| Your email address, or the account identifier Apple or Google gives us | Only when you create an account or sign in | To identify your account and to send you sign-in, confirmation and password-reset mail |
| A display name, if you set one | Only if you type one | Shown to you in the app. It is optional and may be blank |
| Your collection: which Pokemon and forms you have marked caught, shiny or origin, plus any nickname and notes you add, and the names of your boxes | Only while signed in | So your collection survives a lost phone and follows you to a new one |
| A purchase record: which store, that store's transaction identifier, and the product bought | Only if you buy the premium unlock while signed in | To restore your unlock on your other devices and to answer support requests about a purchase |
If you sign in with Apple and use Hide My Email, we receive Apple's relay address and never your real one.
What box1 does not collect
- No analytics and no tracking. The app contains no analytics SDK, no crash reporter, no advertising identifier and no third-party tracker. We do not know how often you open the app or what you tap.
- No advertising. There are no ads and no ad networks.
- No location, contacts, photos, camera or microphone. The app never asks for these permissions.
- No payment details. Purchases are handled entirely by Apple. Your card number never reaches us and we never see it.
- No selling or sharing. We do not sell your data, share it for advertising, or use it to build a profile of you.
Who processes it
We use two service providers, and only for the purposes above:
- Supabase hosts the database that stores your account and your synced collection.
- Resend delivers the transactional email box1 sends you — sign-in codes, address confirmation and password resets. box1 sends no marketing email of any kind.
Apple processes premium purchases through the App Store under Apple's own privacy policy. We receive only a transaction identifier from that process.
Visiting this website
Everything above is about the app. This site is separate and much simpler: it is static pages with no accounts, no cookies, no analytics and no scripts of any kind. It sets nothing in your browser and there is no sign-in.
It is hosted by Netlify, who record standard server access logs — your IP address, the page requested, the time, and your browser's user-agent string — for delivery and abuse prevention. We do not use those logs to build a profile of you and we do not combine them with your box1 account.
How it is protected
Data travels over HTTPS. In the database, every row carrying your data is protected by row-level security keyed to your account, so one account cannot read another's collection. Passwords are stored only as salted hashes and are never readable by us.
How long it is kept
Your account and collection are kept until you delete them. Deleting your account removes everything we hold that is tied to it, purchase records included. That does not cost you the premium unlock: the unlock is held by your App Store account, not by us, and “Restore Purchases” brings it back.
Deleting your data
Open Settings → Delete Account in the app. It deletes your account, your display name, your purchase records and your collection — the copy on your device as well as the synced one — immediately and for good. Your premium unlock is unaffected, as above. Export your collection to a file first, from Settings, if you want to keep it.
If you cannot reach the app — a lost phone, an account you can no longer sign in to — email support@box1.app from the address on your account and we will remove your account and everything synced to it. We cannot reach a copy held on a device we do not have; deleting the app removes that one.
You may also ask us what we hold about you, or ask us to correct it, at the same address.
Children
box1 is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has given us their information, write to support@box1.app and we will delete it.
Changes
If this policy changes materially, the date at the top of this page changes with it and the app will point you here.